October’s #InfosecLunchHour began with a personal experience of mine involving AI and consent, and it quickly grew into one of the most wide ranging discussions the group has had this year.
The room included people from security consultancy, GRC, awareness and culture, product operations, managed security services, academia and design, and we were pleased to welcome several new faces. Under Chatham House Rules, the conversation covered who controls how our images and data end up in AI tools, why so few companies feel any pressure to ask for consent, the role of education from an early age, regulation and supply chain controls and the way AI has lowered the barrier to some forms of online harm.
Setting The Scene: Consent I Was Never Asked For
I opened the session by sharing something which happened to me recently. My birthday is coming up, and a close friend had obviously used an AI tool to create images for a birthday card from personal photos of me, without asking first. The intention was very kind, but the result was that my images went into a system I had no say over, and I have no way of knowing where they are now or how they will be used.
One attendee asked whether I would feel the same if the photo had simply been uploaded to a card website such as Moonpig, with no AI involved. It was a fair challenge. I am not entirely comfortable with that either, although I accept it sits very close to the way we all share photos on Facebook and LinkedIn. Another participant pointed out that many companies accepting user supplied content already claim rights over whatever is uploaded, so the underlying problem predates AI by some distance.
A second example came from the legal sector. A participant described a client who had used ChatGPT to draft a legal letter, and the advice it contained had the potential to cause real harm to someone facing a serious legal matter. The output looked confident and professional, and the person relying on it had no way of judging whether it was correct.
Where Consent Breaks Down
There was broad agreement that preventing other people from putting our images and data into AI tools is close to impossible. Once a photo leaves our hands, control over it goes with it.
One attendee spoke about the importance of personal boundaries in the digital world and argued that consent should apply to sharing photos and connecting online in the same way it applies offline. She also observed that some people feel excluded because they choose not to use platforms such as LinkedIn and suggested cyber diversity education has a place in these conversations about boundaries.
Another participant called for AI companies to take far more responsibility. People deserve transparency about how their images are used, and companies should seek consent rather than assume it. She was also clear that conversations about consent online need to begin at a young age.
From a technical perspective, one attendee explained why consent checks are rarely built into these tools. Any check before an image is processed would require either blanket approval from the third party or a separate approval process, and both introduce delays developers have little incentive to accept.
Business Models and Missing Consequences
A participant working in product operations made the case that companies do carry a responsibility to be clear about how they use data, but their business models often pull in the opposite direction. Full transparency about what happens to personal data does not sit comfortably with a model built on collecting it.
The chat was candid on this point. One attendee observed that business does not care, which is precisely why compliance exists. Another responded that business does not care because there are no consequences, compliance or not. A third agreed, noting that the number of stories about the misuse of people’s images makes the lack of care plain to see. The question nobody could answer neatly was how to introduce meaningful consequences into the equation.
The product operations participant expected effective AI governance to rely more on education than on strict technical controls, drawing a parallel with the early development of the internet, when regulation lagged a long way behind use. One attendee summed up the root cause in a single word: apathy.
Education, Starting in Schools
Schools are beginning to teach responsible use of AI. One attendee shared a BBC News report about Scotland’s first AI literacy teacher, who is warning pupils not to trust everything AI tells them. Others welcomed the development but noted that one school does not amount to a solution unless AI literacy becomes part of the wider education system.
Education was a theme the group returned to repeatedly. One participant compared online safety with road safety: we teach children how to cross the road, and parents and community leaders set the example. Online safety needs the same investment in parental education and leadership.
There was also a note of realism. Even with good education in place, some young people will not fully grasp or care about the risks until something goes wrong for them personally. Any education programme needs to be honest about that limitation.
Regulation, Transparency and the Supply Chain
A participant from a managed security services provider argued that education alone will not solve the problem. Regulation and supply chain measures, such as government certification schemes, would place real pressure on companies to handle data responsibly. He likened education on its own to cleaning a beach: the work matters, but the rubbish keeps arriving until the source is dealt with.
Others identified data transparency and consent as the gaps regulation most needs to close. One attendee highlighted human centred cyber security, an approach NIST is now promoting, as a helpful framework for this work.
The use of AI in the public sector also came up. One attendee raised a British Transport Police facial recognition scheme which reportedly cost £2.85 million without achieving its intended safety outcomes, a reminder that the risks are not confined to private companies.
AI Lowers the Barrier to Harm
One participant made a point which stayed with me after the session. AI has lowered the barrier for certain harmful activities, cyberstalking in particular. Tasks which once required time and skill can now be completed in minutes.
Photos remain one of the easiest ways for people to expose themselves online. One attendee regularly uses I Know Where Your Cat Lives in awareness sessions. The site maps publicly shared cat photos using the location data embedded within them, showing how an innocent picture of a pet reveals where someone, their family and their property are. Several of us will be borrowing it for our own sessions.
Another attendee argued for a broader scope, with AI treated as one part of a wider programme of digital safety education. As another participant put it, this is as much about situational awareness as it is about cyber security.
Ideas To Take Forward
The session produced several practical actions.
- I have an AI responsible use policy for myself as an individual, and I will be updating it to cover what I consent to going into AI tools about me, including my images and personal data. I am also considering adapting it into a template for use by members of the AI and Cyber Security Association (AICSA).
- One attendee proposed a 12-hour half marathon style event focused on AI and cyber security awareness, to be run in support of the AICSA.
- AI and cyber security education has the potential to become a dedicated project for the AICSA, building on the ideas raised in this session.
- An attendee researching diversity, equity, inclusion and AI in the UK infosec workforce for her thesis would welcome advice on academic publication. If you have experience in this area, please get in touch and I will make the introduction.
A Topic for Another Day: TalkTalk and the BT Rescue Deal
Towards the end of the session, two attendees raised the demise of TalkTalk and its implications for cyber security and critical infrastructure. There was far too much to cover in the time remaining, so I have arranged a special one off #InfosecLunchHour session to focus on the TalkTalk and BT rescue deal and the related risks, including the ASOS incident. This session will take place on Thursday 15 October 2026 at 12.30pm BST. All regular #InfosecLunchHour attendees have been added to the calendar invite, and if you would like to join this one-off session, please contact me via lisa@unitysolutions.org.uk to be added to the invite.
Closing Reflections
The discussion kept returning to one central problem. Our images and personal data are moving into AI tools through other people, through platforms and through business models we never agreed to, and consent is rarely sought. Companies currently face few if any consequences when they skip it.
No single measure will fix this. Education needs to start early and continue into adulthood, and regulation and supply chain controls need to place meaningful pressure on the organisations building and selling these tools. Each of us also has a part to play by thinking carefully before we upload an image of someone else, however good our intentions.
My own first step is updating my personal AI responsible use policy, and I would encourage everyone to consider writing one, including a clear statement of what you are and are not willing for AI tools to hold about you. My thanks to everyone who joined and contributed to such a thoughtful discussion.
The next #InfosecLunchHour takes place on Wednesday 4 November 2026 at 12.30pm GMT. If you would like to join a group of cyber and infosec professionals for some relaxed chat over lunch, please contact me via lisa@unitysolutions.org.uk to be added to the calendar invite.
My AI responsible use policy is here to download.
#InfosecLunchHour is a free, open, community networking event hosted by Lisa Ventura MBE FCIIS. All discussions take place under Chatham House Rules: participants may use information shared in the meeting but may not attribute it to named individuals or organisations.
